CVS log for src/usr.sbin/bgpd/printconf.c

Up to [local] / src / usr.sbin / bgpd

Request diff between arbitrary revisions

Default branch: MAIN

Revision 1.182 / (download) - annotate - [select for diffs], Mon Mar 10 14:11:38 2025 UTC (6 months, 2 weeks ago) by claudio
Branch: MAIN
CVS Tags: OPENBSD_7_7_BASE, OPENBSD_7_7, HEAD
Changes since 1.181: +4 -1 lines
Diff to previous 1.181 (colored)

Remove some includes from bgpd.h (poll.h and arpa/inet.h) and place them
into the files that really need them. Also remove stdarg.h since nothing
in bgpd.h needs that.

Revision 1.181 / (download) - annotate - [select for diffs], Mon Jan 27 15:22:11 2025 UTC (7 months, 3 weeks ago) by claudio
Branch: MAIN
Changes since 1.180: +8 -8 lines
Diff to previous 1.180 (colored)

Flip the switch on reject as-set from default no to yes.

BGP AS_PATH AS_SET are deprecated (or in the process to be).
In short AS_SET don't play nice with Route Origin Validation (ROV) and
with ASPA validation any AS_SET makes the path invalid and ineligible.
Right now there are some 200 routes left in the DFZ that use AS_SET so
the impact of this is minimal.

While there cleanup the code and remove some double negations and
NO defines.

OK sthen@ tb@, job@ agrees

Revision 1.180 / (download) - annotate - [select for diffs], Mon Jan 13 13:50:34 2025 UTC (8 months, 1 week ago) by claudio
Branch: MAIN
Changes since 1.179: +6 -1 lines
Diff to previous 1.179 (colored)

Extended nexthop encoding support (RFC8950) for the RIB

This diff allows to establish IPv6 sessions and distribute IPv4 routes
with IPv6 nexthop over those sessions.

This is enough to use RFC 8950 on route reflectors or route servers.
It adds the support for IPv6 nexthops for IPv4 routes to the RDE / RIB.

The problem is that the FIB is not ready for that yet (the nexthop of a
kroute has to be of the same address family as the prefix) and fixing that
is not trivial. Because of this prefixes using a nexthop in a different
address family are not sent to the FIB.

OK tb@

Revision 1.179 / (download) - annotate - [select for diffs], Thu Jan 9 15:57:31 2025 UTC (8 months, 1 week ago) by claudio
Branch: MAIN
Changes since 1.178: +3 -3 lines
Diff to previous 1.178 (colored)

Adjust config of RFC 8654 extended message support.

To allow for RFC 8950 (exteneded nexthop) support adjust the announce
statement for extended message support from:
Old config:
	announce extended yes
New conifg:
	announce extended message yes

OK tb@

Revision 1.178 / (download) - annotate - [select for diffs], Fri Dec 13 19:21:03 2024 UTC (9 months, 1 week ago) by claudio
Branch: MAIN
Changes since 1.177: +9 -1 lines
Diff to previous 1.177 (colored)

Implement RFC 8538: Notification Message Support for BGP Graceful Restart

This is an extension to graceful restart and requires graceful restart to
be enabled to work. The NOTIFICATION bits are implemented as specified but
a much more strict stand was taken as to when send a graceful reset.

bgpd only sends graceful notifications for a few cease cases (same as in
the RFC) and for the holdtimer and sendholdtimer errors. Everything else
is a hard error because the other side is not trustworthy.

OK tb@

Revision 1.177 / (download) - annotate - [select for diffs], Mon Dec 9 10:51:46 2024 UTC (9 months, 2 weeks ago) by claudio
Branch: MAIN
Changes since 1.176: +6 -1 lines
Diff to previous 1.176 (colored)

Add support for extended messages (RFC8654)

This extends the maximum message size of BGP from 4096 to 65535.

This mostly follows rfc8654 with the following differences:
- NOTIFICATIONS are always truncated to fit in 4096 bytes.
- There is no message reduction using "attribute discard" in case of overflow.
- Large messages are only sent if both sides announced extended message support.
OK tb@

Revision 1.176 / (download) - annotate - [select for diffs], Wed Oct 9 10:01:29 2024 UTC (11 months, 2 weeks ago) by claudio
Branch: MAIN
Changes since 1.175: +36 -28 lines
Diff to previous 1.175 (colored)

Make it possible to configure tcp md5 and ipsec on rtr as well

Single out the auth_config yacc rules. Even though this requires an
extra merge_auth_conf() function to handle manual IPsec setups but
even with that this seems like a net gain.

There is no rtr cache that does tcp md5 on OpenBSD so those bits remain
untested for now.
OK tb@

Revision 1.175 / (download) - annotate - [select for diffs], Tue Oct 1 11:49:24 2024 UTC (11 months, 3 weeks ago) by claudio
Branch: MAIN
Changes since 1.174: +37 -39 lines
Diff to previous 1.174 (colored)

Rework the pfkey and tcp md5 API to not depend on struct peer.

Instead use struct auth_config and struct auth_state in the pfkey calls
and those tcp_md5 calls where it matters.

This is preparation work to allow RTR to use TCP MD5 as well.
OK tb@

Revision 1.174 / (download) - annotate - [select for diffs], Wed Aug 14 19:09:51 2024 UTC (13 months, 1 week ago) by claudio
Branch: MAIN
CVS Tags: OPENBSD_7_6_BASE, OPENBSD_7_6
Changes since 1.173: +3 -1 lines
Diff to previous 1.173 (colored)

Introduce 'rde rib Loc-RIB include filtered' a feature that includes
filtered prefixes in the Loc-RIB

This includes filtered prefixes into the Loc-RIB but they are marked
ineligible so nothing will select them but it is possible to show them
in bgpctl. So 'bppctl show rib filtered' will return all prefixes filtered
out by the input filters.

OK tb@

Revision 1.173 / (download) - annotate - [select for diffs], Wed May 22 08:41:14 2024 UTC (16 months ago) by claudio
Branch: MAIN
Changes since 1.172: +3 -3 lines
Diff to previous 1.172 (colored)

Convert bgpid, remote_bgpid and clusterid to host byte order.

Before the RDE used host byte order for remote_bgpid but all the other
code used network byte order. The reason for that was that bgpid was
initially an IPv4 address but since RFC 6286 in 2011 this is much more
relaxed and so it makes more sense to just treat them as numbers and
so host byte order.

OK tb@

Revision 1.172 / (download) - annotate - [select for diffs], Wed Apr 24 10:41:34 2024 UTC (17 months ago) by claudio
Branch: MAIN
Changes since 1.171: +1 -4 lines
Diff to previous 1.171 (colored)

Remove 'announce capabilities' as neighbor config stanza.

There is no need to have an easy knob to get outdated or crappy
implementations to limp along. Instead the various default on
capabilities just need to be disabled (e.g. announce as-4byte no).

OK tb@

Revision 1.171 / (download) - annotate - [select for diffs], Tue Apr 9 09:03:18 2024 UTC (17 months, 2 weeks ago) by claudio
Branch: MAIN
Changes since 1.170: +42 -12 lines
Diff to previous 1.170 (colored)

Allow operators to enforce the presence of certain capabilities on sessions.

For simple capabilities this just adds enforce to the yes/no option of the
announce statement. For multi-protocol capabilities and add-path there is
an extra keyword. On top of this for add-path the enforcement requires the
neighbor to send a matching capability, e.g
'announce add-path recv enforce' requires the other side to send any
'announce add-path send XYZ' capability.

This is mainly to enforce as-4byte and extra multi-protocol capabilities.

OK denis@ tb@

Revision 1.170 / (download) - annotate - [select for diffs], Wed Mar 20 09:35:46 2024 UTC (18 months ago) by claudio
Branch: MAIN
Changes since 1.169: +2 -2 lines
Diff to previous 1.169 (colored)

Cleanup AID handling.

- Loops over all valid AID should start with AID_MIN and go up to AID_MAX - 1
   e.g. for (i = AID_MIN; i < AID_MAX; i++)
  If for some reason AID_UNSPEC must be handled make that explicit in the
  for loop.

- aid2afi() now returns an error for AID_UNSPEC since there is no valid
  AFI SAFI combo for AID_UNSPEC.

- Add additional checks for AID_MIN where currently only AID_MAX was checked.
  This affects imsg for route refresh and graceful restart.

- Simplify add-path capability handling. Only the negotiated add_path capa
  sets the flag for AID_UNSPEC to help code to quickly check if any add-path
  is active.

OK tb@

Revision 1.169 / (download) - annotate - [select for diffs], Wed Jan 10 13:31:09 2024 UTC (20 months, 2 weeks ago) by claudio
Branch: MAIN
CVS Tags: OPENBSD_7_5_BASE, OPENBSD_7_5
Changes since 1.168: +3 -20 lines
Diff to previous 1.168 (colored)

Implement log_roa() and log_aspa() and use these functions in printconf.c
OK tb@

Revision 1.168 / (download) - annotate - [select for diffs], Wed Aug 16 08:26:35 2023 UTC (2 years, 1 month ago) by claudio
Branch: MAIN
CVS Tags: OPENBSD_7_4_BASE, OPENBSD_7_4
Changes since 1.167: +2 -5 lines
Diff to previous 1.167 (colored)

Remove per-AFI ASPA handling in bgpd internals

With draft-ietf-sidrops-aspa-profile-16 and
draft-ietf-sidrops-aspa-verification-15 the AFI dependence of ASPA
records was dropped. So remove this complication form the code.

This only removes the AFI handling internally in bgpd but still allows
the old syntax in aspa-set tables. The optional address family is just
ignored and records are merged together.

For RTR sessions draft-ietf-sidrops-8210bis has not yet been updated so
right now we still handle RTR sessions as specified there. The IPv4 and
IPv6 ASPA entries are handled in two trees and merged together into one
AFI independent tree. This is the best we can do for now until IETF
updates draft-ietf-sidrops-8210bis.

OK tb@ job@

Revision 1.167 / (download) - annotate - [select for diffs], Fri Apr 28 13:23:52 2023 UTC (2 years, 4 months ago) by claudio
Branch: MAIN
Changes since 1.166: +10 -7 lines
Diff to previous 1.166 (colored)

Add explicit default labels in switch() statements with error handling.
Right now these are not reachable. Should also clear some gcc warnings.
OK tb@

Revision 1.166 / (download) - annotate - [select for diffs], Fri Apr 21 10:48:33 2023 UTC (2 years, 5 months ago) by claudio
Branch: MAIN
Changes since 1.165: +7 -1 lines
Diff to previous 1.165 (colored)

Adjust ext community handling to support the generic transitive communities
introduced with flowspec.
OK tb@

Revision 1.165 / (download) - annotate - [select for diffs], Tue Apr 18 14:11:54 2023 UTC (2 years, 5 months ago) by claudio
Branch: MAIN
Changes since 1.164: +115 -5 lines
Diff to previous 1.164 (colored)

Implement a basic flowspec print function. It is not 100% compatible
with the parser but that is for a later time to fix.
OK tb@

Revision 1.164 / (download) - annotate - [select for diffs], Thu Mar 9 13:12:19 2023 UTC (2 years, 6 months ago) by claudio
Branch: MAIN
CVS Tags: OPENBSD_7_3_BASE, OPENBSD_7_3
Changes since 1.163: +3 -3 lines
Diff to previous 1.163 (colored)

Major rework of RFC9234 support. My initial interpretation of the RFC was
too conservative. Fixes and changes include:

- add role output to bgpctl, also adjust the capability output.
  Note, this changes the JSON output of neighbors a bit.
- adjust the config parser to enable the RFC9234 role capability when
  there is a role set. iBGP and sessions with no role will not announce
  the role capability.
- adjust the role capability announcement to be only on sessions that
  use either AFI IPv4 or IPv6 and SAFI 1 (AID_INET, AID_INET6).
- if there is an OPEN notification indicating that the role capability
  is bad only disable the capability if it is not enforced.
- Adjust capability negotiation, store remote_role on the peer since
  the neighbors role is no longer needed by the RDE.
- inject the OTC attribute on ingress only for AID_INET and AID_INET6.
  For other AIDs clear the F_ATTR_OTC_LOOP flag.
- Adjust the role logic in the RDE and use the peer->role (local role of
  the system) for all checks. Also remove the check if the role capability
  was negotiated between peers.
- In prefix_eligible() check also if the F_ATTR_OTC_LOOP flag is set.
  The RFC requires that prefixes must be considered ineligible (and not
  treat as withdraw as done before)
- When generating an UPDATE include the OTC attribute unless the AID is
  neither AID_INET or AID_INET6.

Fixes https://github.com/openbgpd-portable/openbgpd-portable/issues/51
Reported by Pier Carlo Chiodi
OK tb@

Revision 1.163 / (download) - annotate - [select for diffs], Tue Jan 24 14:13:12 2023 UTC (2 years, 8 months ago) by claudio
Branch: MAIN
Changes since 1.162: +17 -1 lines
Diff to previous 1.162 (colored)

Implement filter and control message matching for ASAP.

This adds avs (ASPA validation state) which can be 'unknown', 'valid'
or 'invalid'. It behaves similar to ovs but the ASPA validation state
of paths from iBGP sessions is 'unknown' and the role of the ebgp session
is important to get the right validation state.

OK tb@

Revision 1.162 / (download) - annotate - [select for diffs], Fri Jan 20 15:41:33 2023 UTC (2 years, 8 months ago) by claudio
Branch: MAIN
Changes since 1.161: +3 -4 lines
Diff to previous 1.161 (colored)

Document the aspa-set table. While there remove the superfluous 'allow'
keyword.
OK tb@

Revision 1.161 / (download) - annotate - [select for diffs], Wed Jan 4 14:33:30 2023 UTC (2 years, 8 months ago) by claudio
Branch: MAIN
Changes since 1.160: +5 -5 lines
Diff to previous 1.160 (colored)

Add a per eBGP session role to the config.

This somewhat replaces the RFC 9234 open policy role. This is done because
ASPA requires the same role to be present to properly validate paths.
For iBGP sessions the role is forced to ROLE_NONE. If no role is set on
an ebgp session then 'announce policy' is forced to 'no'.
Also make sure the the role capability is only added if the role is set.
OK tb@

Revision 1.160 / (download) - annotate - [select for diffs], Fri Nov 18 10:17:23 2022 UTC (2 years, 10 months ago) by claudio
Branch: MAIN
Changes since 1.159: +30 -1 lines
Diff to previous 1.159 (colored)

Add plumbing for ASPA support. This implements the parser and part of the
logic in the rtr process. It does not implement the new RTR messages yet
but it is possible to specify an aspa-set in the config. Also the validation
code in the RDE is missing so this does not do anything.
With this in it will be possible to extend rpki-client to publish an
aspa-set as part of the openbgpd config file.
OK tb@

Revision 1.159 / (download) - annotate - [select for diffs], Wed Sep 21 21:12:04 2022 UTC (3 years ago) by claudio
Branch: MAIN
CVS Tags: OPENBSD_7_2_BASE, OPENBSD_7_2
Changes since 1.158: +2 -2 lines
Diff to previous 1.158 (colored)

The values for fib_priority are OS dependent. To help portability move
the RTP_BGP and similar defines all into kroute.c and export them via
kr_default_prio() and kr_check_prio().
OK tb@

Revision 1.158 / (download) - annotate - [select for diffs], Wed Aug 17 09:15:06 2022 UTC (3 years, 1 month ago) by claudio
Branch: MAIN
Changes since 1.157: +3 -1 lines
Diff to previous 1.157 (colored)

Add default case to switch to silence a warning seen with gcc.

Revision 1.157 / (download) - annotate - [select for diffs], Thu Jul 28 13:11:50 2022 UTC (3 years, 1 month ago) by deraadt
Branch: MAIN
Changes since 1.156: +4 -4 lines
Diff to previous 1.156 (colored)

whitespace found during a read-thru; ok claudio

Revision 1.156 / (download) - annotate - [select for diffs], Mon Jul 11 17:08:21 2022 UTC (3 years, 2 months ago) by claudio
Branch: MAIN
Changes since 1.155: +27 -1 lines
Diff to previous 1.155 (colored)

Implement send side of RFC7911 ADD-PATH

This allows to send out more then one path per perfix to a neighbor that
supports add-path receive. OpenBGPD supports a few different modes to
select which paths to send:
  - all:	send all valid paths (the ones with a * in bgpctl output)
  - best:	send out only the single best path
  - ecmp:	send out paths that evaluate the same up and including
                the nexthop metric
  - as-wide-best: send out paths that evaluete the same up but not including
		  the nexthop metric
Currently ecmp and as-wide-best are the same. On top of this best, ecmp
and as-wide-best allow to include extra paths (e.g. best plus 2) and
for the multipath modes there is also a maximum (e.g. ecmp plus 2 max 4)

OK tb@

Revision 1.155 / (download) - annotate - [select for diffs], Tue Jun 28 11:46:05 2022 UTC (3 years, 2 months ago) by claudio
Branch: MAIN
Changes since 1.154: +3 -3 lines
Diff to previous 1.154 (colored)

The default state of enhanced refresh is no. So flip logic.
Fixes config regress. Found by anton@, discussed with tb@

Revision 1.154 / (download) - annotate - [select for diffs], Mon Jun 27 13:26:51 2022 UTC (3 years, 2 months ago) by claudio
Branch: MAIN
Changes since 1.153: +21 -9 lines
Diff to previous 1.153 (colored)

Add support for RFC 9234 - Route Leak Prevention and Detection Using Roles

With this it is possible to send a role in the OPEN message and if that
was successful the RDE will add the new OTC attribute if necessary.
OK tb@

Revision 1.153 / (download) - annotate - [select for diffs], Wed Jun 15 14:09:30 2022 UTC (3 years, 3 months ago) by claudio
Branch: MAIN
Changes since 1.152: +9 -9 lines
Diff to previous 1.152 (colored)

Do not use defines from pfkeyv2.h in portable code.

Instead define our own algorithm enums for the IPsec code.
OK tb@ sthen@

Revision 1.152 / (download) - annotate - [select for diffs], Tue May 31 09:45:33 2022 UTC (3 years, 3 months ago) by claudio
Branch: MAIN
Changes since 1.151: +8 -1 lines
Diff to previous 1.151 (colored)

Implement a max communities filter match

When max-communities X is set on a filterrule the filter will match when
more than X communities are present in the path. In other words
max-communities 0 means no communities are allowed and max-communities 3
limits it up to 3 communities.
There is max-communities, max-ext-communities and max-large-communities
for each of the 3 community attributes. These three max checks can be used
together.
OK tb@ job@

Revision 1.151 / (download) - annotate - [select for diffs], Wed May 25 16:03:34 2022 UTC (3 years, 4 months ago) by claudio
Branch: MAIN
Changes since 1.150: +2 -2 lines
Diff to previous 1.150 (colored)

Fix non-transitive extended community handling.
First of all the detection logic was totally wrong. Then filter out
non-transitive extended communities when received from an ebgp peer.
Also cleanup the type handling of ext-communities. Mainly to not have
to handle the transitive vs non-transitive versions the type is masked
with EXT_COMMUNITY_VALUE before doing the switch case for the various
types.
With this my test using ext-communities works.
OK tb@

Revision 1.150 / (download) - annotate - [select for diffs], Wed Feb 23 11:20:35 2022 UTC (3 years, 7 months ago) by claudio
Branch: MAIN
CVS Tags: OPENBSD_7_1_BASE, OPENBSD_7_1
Changes since 1.149: +13 -3 lines
Diff to previous 1.149 (colored)

Make it possible to bind and connect to non-default ports. This is mainly
for testing. Using alternate ports does not work for session using ipsec.
OK tb@ deraadt@

Revision 1.149 / (download) - annotate - [select for diffs], Sun Feb 6 09:51:19 2022 UTC (3 years, 7 months ago) by claudio
Branch: MAIN
Changes since 1.148: +18 -18 lines
Diff to previous 1.148 (colored)

Switch from u_intX_t types to stdint.h uintX_t. Mostly mechanical with
a few reindents.
OK florian@ tb@

Revision 1.148 / (download) - annotate - [select for diffs], Wed Sep 1 12:39:52 2021 UTC (4 years ago) by claudio
Branch: MAIN
CVS Tags: OPENBSD_7_0_BASE, OPENBSD_7_0
Changes since 1.147: +3 -1 lines
Diff to previous 1.147 (colored)

Implement roa-set data expiry. Every prefix in a roa-set can specify an
optional expires timestamp. The rtr process is walking the roa-set every
5min and removes every prefix that is expired.
With this stale RPKI data will slowly disapear and not linger around.
OK job@

Revision 1.147 / (download) - annotate - [select for diffs], Tue Mar 2 09:45:07 2021 UTC (4 years, 6 months ago) by claudio
Branch: MAIN
CVS Tags: OPENBSD_6_9_BASE, OPENBSD_6_9
Changes since 1.146: +11 -2 lines
Diff to previous 1.146 (colored)

Introduce 'rde evaluate all' a mode to work around path hiding in IXP
route-server environments.

By default only the best path is sent to peers and if that path is filtered
then the path is hidden for that peer. On route-servers this is sometimes
not desried. For this 'rde evaluate all' will cause the evaluation process
to fall back to alternate routes and will redistribute the first non-filtered
path to the peer. This is very similar to per-peer RIBs but accomplishes
the same effect without the massive increase in memory usage. Compared to
the default mode this requires more CPU resources but it is probably less
than what per-peer RIBs would require.

'rde evaluate all' can be set and reset globally, on groups and on idividual
neighbors. It is not limited to route-server configs but route loops are
possible if not properly used.

OK benno@

Revision 1.146 / (download) - annotate - [select for diffs], Tue Feb 16 08:29:16 2021 UTC (4 years, 7 months ago) by claudio
Branch: MAIN
Changes since 1.145: +18 -1 lines
Diff to previous 1.145 (colored)

Add RTR support to OpenBGPD. Add basic support for the protocol.
The RTR client runs in a new process where the protocol handling is done
and when new data is available all sources are merged into one ROA set
which is then loaded into the RDE. The roa-set from the config is also
handled by the new RTR engine.
Tested by and ok job@

Revision 1.145 / (download) - annotate - [select for diffs], Mon Jan 25 09:15:23 2021 UTC (4 years, 7 months ago) by claudio
Branch: MAIN
Changes since 1.144: +12 -1 lines
Diff to previous 1.144 (colored)

RFC6472 discourages the use of AS_SET segements in ASPATH attributes.
The main reason is that AS_SET does not play nice with RPKI ROA.

Introduce a per neighbor and global config option
    'reject as-set yes' and 'reject as-set no'
If set to yes received UPDATES with AS_SET segements are rejected.
This is done the same way other ASPATH soft-errors are handled. The UPDATE
is marked invalid and all prefixes are treated as withdraws.
`bgpctl show rib in error` can be used to show prefixes that where denied
and treated as withdraws because of errors.

By default this feature is off.

OK benno@

Revision 1.144 / (download) - annotate - [select for diffs], Tue Dec 29 15:30:34 2020 UTC (4 years, 8 months ago) by claudio
Branch: MAIN
Changes since 1.143: +24 -28 lines
Diff to previous 1.143 (colored)

In preparation for RTR support change the representation of the roa-set
in the parent to a simple RB tree based on struct roa. With this overlapping
ROAs (same prefix & source-as but different maxlen) are now merged in the RDE
when the lookup trie is constructed.
OK benno@

Revision 1.143 / (download) - annotate - [select for diffs], Thu Nov 5 11:51:13 2020 UTC (4 years, 10 months ago) by claudio
Branch: MAIN
Changes since 1.142: +2 -1 lines
Diff to previous 1.142 (colored)

Refactor the filterset handling of nexthops. Instead of depending on
bgpd_process and changing the behaviour that way add a new filterset
type ACTION_SET_NEXTHOP_REF which is used when the nexthop reference
of the union is used. Adjust the RDE to convert ACTION_SET_NEXTHOP to
ACTION_SET_NEXTHOP_REF when receiving the filtersets.
OK benno@

Revision 1.142 / (download) - annotate - [select for diffs], Thu Apr 23 16:13:11 2020 UTC (5 years, 5 months ago) by claudio
Branch: MAIN
CVS Tags: OPENBSD_6_8_BASE, OPENBSD_6_8, OPENBSD_6_7_BASE, OPENBSD_6_7
Changes since 1.141: +7 -3 lines
Diff to previous 1.141 (colored)

Store local-address by address family. This allows to configure both
an IPv4 and IPv6 local-address on a group and the neighbors bind to the
right local-address. Also implement 'no local-address' to reset a previously
set local address back to zero. This should help with IBGP and multihop
session config and hopefully reduce repetition in bgpd configs.
OK sthen@ benno@

Revision 1.141 / (download) - annotate - [select for diffs], Fri Jan 24 05:44:05 2020 UTC (5 years, 8 months ago) by claudio
Branch: MAIN
Changes since 1.140: +7 -1 lines
Diff to previous 1.140 (colored)

Implement 'max-prefix NUM out' to limit the number of announced prefixes.
This is an easy safety switch to not leak full tables to upstreams and
peers. If the limit is hit a Cease notification is sent and the session
is closed.
This implements most of https://tools.ietf.org/html/draft-sa-idr-maxprefix-00
OK job@

Revision 1.140 / (download) - annotate - [select for diffs], Wed Aug 7 10:26:41 2019 UTC (6 years, 1 month ago) by claudio
Branch: MAIN
CVS Tags: OPENBSD_6_6_BASE, OPENBSD_6_6
Changes since 1.139: +1 -4 lines
Diff to previous 1.139 (colored)

Improve RIB reload behaviour. Especially when the rtable changes or the
route evaluation is modified. In both cases the softreconfig code will
now walk the RIB and ensure that everything is in proper sync.
Additionally remove 'route-collector yes|no' from the bgpd config, instead
use 'rde rib Loc-RIB no evaluate' with the benefit that you can alter
the setting now during runtime.
Tested and OK benno@

Revision 1.139 / (download) - annotate - [select for diffs], Mon Aug 5 08:46:55 2019 UTC (6 years, 1 month ago) by claudio
Branch: MAIN
Changes since 1.138: +2 -2 lines
Diff to previous 1.138 (colored)

Cleanup config reload in the RDE. Use the bgpd_conf struct to store sets
and l3vpns instead of temporary globals. Also rework rde_reload_done to
free filters and sets earlier. The soft-reconfiguration process no longer
needs the previous filters / sets to do its work since there is a full
Adj-RIB-Out.
OK benno@

Revision 1.138 / (download) - annotate - [select for diffs], Wed Jul 24 20:25:27 2019 UTC (6 years, 2 months ago) by benno
Branch: MAIN
Changes since 1.137: +1 -2 lines
Diff to previous 1.137 (colored)

mrt.h only needs to be included by mrt.c
ok claudio@

Revision 1.137 / (download) - annotate - [select for diffs], Mon Jun 17 13:35:43 2019 UTC (6 years, 3 months ago) by claudio
Branch: MAIN
Changes since 1.136: +2 -2 lines
Diff to previous 1.136 (colored)

Cleanup, remove some unneded spaces add some other where needed.
No binary change according to clang

Revision 1.136 / (download) - annotate - [select for diffs], Mon Jun 17 11:02:19 2019 UTC (6 years, 3 months ago) by claudio
Branch: MAIN
Changes since 1.135: +43 -41 lines
Diff to previous 1.135 (colored)

Completley rewrite the community matching and handling code. All community
attributes are put into a new data structure when parsing the UPDATE.
The filter code can quickly lookup and modify this data structure.
When creating an UPDATE the data is put back into wire format.
Setups using a lot of communities benefit a lot from this.
Input and OK benno@

Revision 1.135 / (download) - annotate - [select for diffs], Mon May 27 09:14:32 2019 UTC (6 years, 3 months ago) by claudio
Branch: MAIN
Changes since 1.134: +5 -5 lines
Diff to previous 1.134 (colored)

Switch the peer TAILQ to a RB tree indexed by the peer id. This way
getpeerbyid() gets a lot quicker at finding the peer when many peers
are configured. In my test case the difference is around 20% runtime.
OK denis@

Revision 1.134 / (download) - annotate - [select for diffs], Sun Mar 31 16:57:38 2019 UTC (6 years, 5 months ago) by claudio
Branch: MAIN
CVS Tags: OPENBSD_6_5_BASE, OPENBSD_6_5
Changes since 1.133: +20 -23 lines
Diff to previous 1.133 (colored)

Move the struct peer into bgpd_config and switch it to a TAILQ instead of
the hand-rolled list. This changes the way peers are reloaded since now
both parent and session engine are now merging the lists.
OK denis@

Revision 1.133 / (download) - annotate - [select for diffs], Fri Mar 15 09:54:54 2019 UTC (6 years, 6 months ago) by claudio
Branch: MAIN
Changes since 1.132: +9 -7 lines
Diff to previous 1.132 (colored)

Set all default values in init_config in parse.y and remove the special
ones in session.c. Adjust printconfig a bit to only show non default values
and move mrt_mergeconfig into merge_conifg where it kind of belongs.
OK benno@

Revision 1.132 / (download) - annotate - [select for diffs], Tue Feb 26 10:49:15 2019 UTC (6 years, 6 months ago) by claudio
Branch: MAIN
Changes since 1.131: +46 -14 lines
Diff to previous 1.131 (colored)

Add support for '*', local-as and neighbor-as for ext-community matching
and setting. This allows rules like:
    ext-community * * # delete any ext-community
    ext-community ovs * # delete any ext-community of specified type
    ext-community rt 1.2.3.4:*
and
    ext-community rt 65001:local-as
    ext-community rt local-as:11111

Note: Sometimes the type of the ext-community is underspecified when using
wildchars or expands.  So 'ext-community rt *' or 'ext-community soo *' will
match for any of the 3 possible types (2-byte AS, 4-byte AS and IP address).
If local-as/neighbor-as is used as an expand of as-number like
    ext-community rt local-as:11111
then bgpd will default to the 4-byte AS type to encode the community.

OK benno@

Revision 1.131 / (download) - annotate - [select for diffs], Mon Feb 18 11:43:44 2019 UTC (6 years, 7 months ago) by claudio
Branch: MAIN
Changes since 1.130: +5 -5 lines
Diff to previous 1.130 (colored)

For portability use a (unsigned long long) cast for %llu / %llx formats
in printf since not all systems use unsigned long long for u_int64_t.

Revision 1.130 / (download) - annotate - [select for diffs], Mon Feb 18 09:43:57 2019 UTC (6 years, 7 months ago) by claudio
Branch: MAIN
Changes since 1.129: +2 -2 lines
Diff to previous 1.129 (colored)

Do not depend on the length field of struct sockaddr instead pass the
length to the various functions needing it. Helps portability.
OK benno@

Revision 1.129 / (download) - annotate - [select for diffs], Tue Feb 12 09:00:56 2019 UTC (6 years, 7 months ago) by claudio
Branch: MAIN
Changes since 1.128: +2 -2 lines
Diff to previous 1.128 (colored)

Remove extra newline when printing vpn blocks

Revision 1.128 / (download) - annotate - [select for diffs], Mon Feb 11 15:44:25 2019 UTC (6 years, 7 months ago) by claudio
Branch: MAIN
Changes since 1.127: +18 -21 lines
Diff to previous 1.127 (colored)

The definition of VPNs in bgpd was never super elegant. The 'depend on
mpeX' config was a bit redundant. Also to make it more flexible (e.g. having
more than one mpeX interface per rdomain the syntax was changed.

To make this possible especially the network distribution logic had to be
adjusted and cleaned up. This should in general make network statements
well defined and conflicts between 'network A.B.C.D/N' and e.g. 'network static'
are handled in a well defined way ('network A.B.C.D/N' has preference).

With and OK dlg@, OK denis@

Revision 1.127 / (download) - annotate - [select for diffs], Mon Feb 4 18:53:10 2019 UTC (6 years, 7 months ago) by claudio
Branch: MAIN
Changes since 1.126: +4 -1 lines
Diff to previous 1.126 (colored)

Implement as-override, a feature where the neighbor AS is replaced by the
local AS in AS paths. This is sometimes needed in bigger transport networks
where private AS numbers are used in multiple locations.
The implementation is done using a filterset which modifies the AS path -
somewhat inspired by the set attribute code. Setting as-override yes will add
    match from <neighbor> set { as-override }
to the start of the filter rules. Since this is filters the Adj-RIB-In still
holds the original path and so reloads changing the setting just work.
With and OK markus@

Revision 1.126 / (download) - annotate - [select for diffs], Sun Dec 30 13:53:07 2018 UTC (6 years, 8 months ago) by denis
Branch: MAIN
Changes since 1.125: +2 -1 lines
Diff to previous 1.125 (colored)

add support for IPv6 VPN routes

The kernel bits are missing as of now. With input from claudio@ and kn@

OK claudio@

Revision 1.125 / (download) - annotate - [select for diffs], Wed Dec 19 15:26:42 2018 UTC (6 years, 9 months ago) by claudio
Branch: MAIN
Changes since 1.124: +42 -58 lines
Diff to previous 1.124 (colored)

Fold ext-communities into filter_community so that bgpd can match
multiple ext-communities at the same time as well. Additionally this fixes
parsing some of the ext-community types. Now all communities are handled
by one common struct.
OK benno@ plus some input from denis@

Revision 1.124 / (download) - annotate - [select for diffs], Wed Nov 28 08:32:27 2018 UTC (6 years, 9 months ago) by claudio
Branch: MAIN
Changes since 1.123: +103 -83 lines
Diff to previous 1.123 (colored)

Start reworking community handling. Merge standard communities and large
communities into one filter_community struct and allow it that more then
one community can be used in filter rules (currently up to 3).
Also rework the code handling bgpctl show rib commands. The special IMSG
types for the various filters are gone and the code is in general simpler.
OK job@, phessler@

Revision 1.123 / (download) - annotate - [select for diffs], Sat Sep 29 08:11:11 2018 UTC (6 years, 11 months ago) by claudio
Branch: MAIN
CVS Tags: OPENBSD_6_4_BASE, OPENBSD_6_4
Changes since 1.122: +55 -15 lines
Diff to previous 1.122 (colored)

Implement origin validation in bgpd. This introduces two new tables, the
roa-set for RPKI based origin validation and a origin-set which allows to
lookup a source-as / prefix pair.
For RPKI a config can be built like this:
  roa-set {
          165.254.255.0/24 source-as 15562
          193.0.0.0/21 maxlen 24 source-as 3333
  }
  deny from any ovs invalid
  match from any ovs valid set community local-as:42
  match from any ovs not-found set community local-as:43
Origin sets are similar but only match when the source-as / prefix pair is
valid.
  match from any origin-set ARINDB set community local-as:44
Committing this now so that further work can be done in tree.
OK benno@, job@

Revision 1.122 / (download) - annotate - [select for diffs], Fri Sep 21 04:55:27 2018 UTC (7 years ago) by claudio
Branch: MAIN
Changes since 1.121: +32 -1 lines
Diff to previous 1.121 (colored)

Implement code to parse, print and reload roa-set tables.
This is sharing a lot of code with prefixset which makes all a bit easier.
A roa-set is defined like this:
roa-set "test2" {
  1.2.3.0/24 source-as 1,
  1.2.8.0/22 maxlen 24 source-as 3
}
No support for acting on this data yet.
Put it in deraadt@, OK benno@, input and OK denis@

Revision 1.121 / (download) - annotate - [select for diffs], Thu Sep 20 11:45:59 2018 UTC (7 years ago) by claudio
Branch: MAIN
Changes since 1.120: +25 -2 lines
Diff to previous 1.120 (colored)

Split up as_set into a set_table and an as_set. The first is what does
the lookup and will now also be used in roa-set tries. The as_set is glue
to add the name and dirty flag. Add an accessor to get the set data so
that the imsg sending and printing can be moved into the right places.
This is done mainly because roa-sets need similar but slightly different
versions and making the code more generic is the best way fixing this.
OK benno@

Revision 1.120 / (download) - annotate - [select for diffs], Thu Sep 20 07:46:39 2018 UTC (7 years ago) by claudio
Branch: MAIN
Changes since 1.119: +2 -2 lines
Diff to previous 1.119 (colored)

Switch prefixset to an RB_TREE instead of a SIMPLEQ. This allows to trigger
on duplicates (which are only reported) but is needed as a preparation step
for roa-sets.
OK benno@ denis@

Revision 1.119 / (download) - annotate - [select for diffs], Thu Sep 13 11:25:41 2018 UTC (7 years ago) by claudio
Branch: MAIN
Changes since 1.118: +3 -3 lines
Diff to previous 1.118 (colored)

Noticed that the equal case is a bit wrong while adjusting the regress tests.
This is better. There is no need to check for the prefix length p->len.

Revision 1.118 / (download) - annotate - [select for diffs], Thu Sep 13 11:16:21 2018 UTC (7 years ago) by claudio
Branch: MAIN
Changes since 1.117: +6 -5 lines
Diff to previous 1.117 (colored)

ROA entires are allowing to define a prefix with a maxlen.
In the end this is just another way to specify a prefixlen range
and kind of an or-longer case with an upper limit.
So these two prefix statements are equivalent:
       prefix 10.0.0.0/8 prefixlen 8 - 24
       prefix 10.0.0.0/8 maxlen 24
While there also make 'prefixlen = 17' a OP_RANGE and because of that also
usable in prefix-set tables. Finally adjust printconf.c for those to
changes to print them nicely.
OK phessler@

Revision 1.117 / (download) - annotate - [select for diffs], Mon Sep 10 11:01:15 2018 UTC (7 years ago) by benno
Branch: MAIN
Changes since 1.116: +7 -7 lines
Diff to previous 1.116 (colored)

remove some empty lines from printconf output. ok claudio@

Revision 1.116 / (download) - annotate - [select for diffs], Sun Sep 9 13:22:41 2018 UTC (7 years ago) by claudio
Branch: MAIN
Changes since 1.115: +22 -16 lines
Diff to previous 1.115 (colored)

Rework the parser a bit to be more sane when it comes to newline and comma
handling. In expansion lists we want that commas and newlines are allowed
but optional. In the neighbor, group and rdomain blocks statements need to
be newline separated but neighbor 192.0.2.3 { descr "test-peer" } is allowed.
OK sthen@ benno@

Revision 1.115 / (download) - annotate - [select for diffs], Sun Sep 9 11:00:51 2018 UTC (7 years ago) by benno
Branch: MAIN
Changes since 1.114: +7 -3 lines
Diff to previous 1.114 (colored)

Add network prefix-set <name> syntax to announce networks in a prefix-set.
feature discussed with deraadt@ and job@, ok claudio@

Revision 1.114 / (download) - annotate - [select for diffs], Sat Sep 8 15:25:27 2018 UTC (7 years ago) by benno
Branch: MAIN
Changes since 1.113: +3 -1 lines
Diff to previous 1.113 (colored)

implement or-longer filter op for prefix-sets. Allows one two write rules like
  deny from any prefix-set mynetworks or-longer
ok claudio, feature discussed with job and deraadt

Revision 1.113 / (download) - annotate - [select for diffs], Sat Sep 8 09:33:54 2018 UTC (7 years ago) by claudio
Branch: MAIN
Changes since 1.112: +9 -5 lines
Diff to previous 1.112 (colored)

Change the way we parse prefix-sets so that newlines are allowed in more
places and so prefix-sets look a lot better. Currently commas are not allowed
but they will come back soon.
OK benno@

Revision 1.112 / (download) - annotate - [select for diffs], Fri Sep 7 05:43:33 2018 UTC (7 years ago) by claudio
Branch: MAIN
Changes since 1.111: +6 -2 lines
Diff to previous 1.111 (colored)

Implement as-set a fast lookup table to be used instead of long list of
AS numbers in source-as, AS and transit-as filterstatements. These table
use bsearch to quickly verify if an AS is in the set or not.
The filter syntax is not fully set in stone yet.
OK denis@ benno@ and previously OK deraadt@

Revision 1.111 / (download) - annotate - [select for diffs], Wed Sep 5 17:32:43 2018 UTC (7 years ago) by claudio
Branch: MAIN
Changes since 1.110: +36 -54 lines
Diff to previous 1.110 (colored)

Implement most prefixlen operations as OP_RANGE (prefixlen A - B).
Simplify the RDE logic this way and make it possible to load such ranges
into a much faster lookup trie for prefix-sets.
When printing the config bgpd tries to use the nices way to express the rule:
e.g.    match from any prefix 18.0.0.0/8 prefixlen 8 - 32
becomes match from any prefix 18.0.0.0/8 or-longer
Apart from that there is no user visible change because of this.
OK sthen@

Revision 1.110 / (download) - annotate - [select for diffs], Wed Sep 5 09:49:57 2018 UTC (7 years ago) by claudio
Branch: MAIN
Changes since 1.109: +3 -3 lines
Diff to previous 1.109 (colored)

Change the way as_compare() and aspath_match() handle 'neighbor-as'. Instead
of doing the condition before calling aspath_match() just pass the neighbor-as
down to as_compare() which then has all needed data for the lookup. While
doing this also remove one of the as fields in struct filter_as since the
min/max fields can be reused for unary operations.
OK denis@ phessler@

Revision 1.109 / (download) - annotate - [select for diffs], Wed Jul 11 14:08:46 2018 UTC (7 years, 2 months ago) by benno
Branch: MAIN
Changes since 1.108: +5 -1 lines
Diff to previous 1.108 (colored)

add option "network ... priority number" to announce prefixes from the
kernel routing table selected by priority.
For example to import all ospfd/ospf6d routes into bgp.
tested by remi@
ok remi@ henning@ and maybe a little claudio@

Revision 1.108 / (download) - annotate - [select for diffs], Wed Jun 13 09:33:51 2018 UTC (7 years, 3 months ago) by claudio
Branch: MAIN
Changes since 1.107: +5 -11 lines
Diff to previous 1.107 (colored)

Deprecate announce (all|self|none|default-route)
The announce keyword was overloaded and confused a lot of operators, time
to clean it up and while there incorporate RFC8212 guideline for propagation.
- `announce all` is the new default but the default deny filter will
  make sure that by default nothing is leaked
- `announce self` is no more and results in syntax error
- `announce none` is now `export none`
- `announce default-route` becomes `export default-route`
- the filters are switched to a default deny rule both incoming and outgoing

You most certainly need to adjust your config!

Best is to change the config in advance by using `announce all` explicitly on
all neighbors and adding `deny from any` and `deny to any` at the start of
your filters and adjust the rest of the filters to still produce the same
result.  `bgpd -nv -f bgpd.conf ` and `bgpctl show rib out nei foo` are good
tools to verify the changes.
Lots of discussions with job@, deraadt@, sthen@
OK job@

Revision 1.107 / (download) - annotate - [select for diffs], Sat Feb 10 01:24:28 2018 UTC (7 years, 7 months ago) by benno
Branch: MAIN
CVS Tags: OPENBSD_6_3_BASE, OPENBSD_6_3
Changes since 1.106: +36 -1 lines
Diff to previous 1.106 (colored)

Add prefix-sets, lists of prefixes which can be used in place of a
prefix in a filter rule. Initial idea hashed out with job@ in Toronto.
This is WIP, i'm commiting it now so we can work on it in the tree.
ok florian@ claudio@

Revision 1.106 / (download) - annotate - [select for diffs], Sat Aug 12 16:47:50 2017 UTC (8 years, 1 month ago) by phessler
Branch: MAIN
CVS Tags: OPENBSD_6_2_BASE, OPENBSD_6_2
Changes since 1.105: +5 -1 lines
Diff to previous 1.105 (colored)

allow filter rules to be written that affect ibgp or ebgp neighbors

discussed with henning@
OK claudio@, benno@, job@

Revision 1.105 / (download) - annotate - [select for diffs], Fri Aug 11 16:02:53 2017 UTC (8 years, 1 month ago) by claudio
Branch: MAIN
Changes since 1.104: +1 -12 lines
Diff to previous 1.104 (colored)

softreconfig in and out are on by default for ever and machines now have
enough memory that it does not make sense to provide these knobs anymore.
They just make the code more complex for no much gain.
OK phessler@, benno@

Revision 1.104 / (download) - annotate - [select for diffs], Wed May 31 10:44:00 2017 UTC (8 years, 3 months ago) by claudio
Branch: MAIN
Changes since 1.103: +32 -18 lines
Diff to previous 1.103 (colored)

Rework the way we do extended communities (mainly in the parser) and update
the IANA table to a somewhat more complete list. This includes BGP Prefix
Origin Validation State support via the ext-community ovs keyword.
OK henning@ benno@ based on a diff by Job Snijders

Revision 1.103 / (download) - annotate - [select for diffs], Sat May 27 18:12:23 2017 UTC (8 years, 3 months ago) by phessler
Branch: MAIN
Changes since 1.102: +5 -1 lines
Diff to previous 1.102 (colored)

Allow an administrator to disable the bgp loop detection algorithm,
which is useful in very limited situations.

Angry dragons and grues will hunt for you, if you use it.

OK claudio@ sthen@ benno@

Revision 1.102 / (download) - annotate - [select for diffs], Sat May 27 10:33:15 2017 UTC (8 years, 3 months ago) by phessler
Branch: MAIN
Changes since 1.101: +7 -1 lines
Diff to previous 1.101 (colored)

Allow OpenBGPD to selectively choose which local ASN to use per-peer.
This is intended to be used for ASN migrations, not for permanent use.

You MUST use filters to protect yourself from receiving your own routes.
There be dragons and grues.

OK claudio@ benno@

Revision 1.101 / (download) - annotate - [select for diffs], Sat May 27 10:24:44 2017 UTC (8 years, 3 months ago) by phessler
Branch: MAIN
Changes since 1.100: +11 -1 lines
Diff to previous 1.100 (colored)

allow us to use 'local-as' in the filter language

"match in from any set community local-as:neighbor-as"

OK claudio@

Revision 1.100 / (download) - annotate - [select for diffs], Tue Jan 24 04:22:42 2017 UTC (8 years, 8 months ago) by benno
Branch: MAIN
CVS Tags: OPENBSD_6_1_BASE, OPENBSD_6_1
Changes since 1.99: +2 -1 lines
Diff to previous 1.99 (colored)

sync log.c from relayd et al to bgpd.

there is still a little difference regarding handling of the verbosity
value that will be handled later.

ok claudio@ florian@

Revision 1.99 / (download) - annotate - [select for diffs], Fri Oct 14 16:05:36 2016 UTC (8 years, 11 months ago) by phessler
Branch: MAIN
Changes since 1.98: +51 -1 lines
Diff to previous 1.98 (colored)

Add support for draft-ietf-idr-large-community

Joint work with Job Snijders, many thanks!
OK benno@ deraadt@

Revision 1.98 / (download) - annotate - [select for diffs], Wed Oct 5 07:38:06 2016 UTC (8 years, 11 months ago) by phessler
Branch: MAIN
Changes since 1.97: +5 -1 lines
Diff to previous 1.97 (colored)

Let bgpd announce routes based on a route-label.

OK henning@ benno@

Revision 1.97 / (download) - annotate - [select for diffs], Wed Jul 13 20:07:38 2016 UTC (9 years, 2 months ago) by benno
Branch: MAIN
CVS Tags: OPENBSD_6_0_BASE, OPENBSD_6_0
Changes since 1.96: +29 -7 lines
Diff to previous 1.96 (colored)

output the no-longer-so-new AS operators when printing the
configuration
noticed by and diff from Denis Fondras, thanks!

ok phessler@ sthen@

Revision 1.96 / (download) - annotate - [select for diffs], Mon Sep 21 09:47:15 2015 UTC (10 years ago) by phessler
Branch: MAIN
CVS Tags: OPENBSD_5_9_BASE, OPENBSD_5_9
Changes since 1.95: +4 -1 lines
Diff to previous 1.95 (colored)

Let us log all updates sent from an individual peer.  Since this can be
applied to a group, also let us disable logging on a sub-member of the
group.  Very handy for debugging naughty peers on a router with multiple
peers.

OK benno@

Revision 1.95 / (download) - annotate - [select for diffs], Thu Jul 16 18:26:04 2015 UTC (10 years, 2 months ago) by claudio
Branch: MAIN
CVS Tags: OPENBSD_5_8_BASE, OPENBSD_5_8
Changes since 1.94: +9 -10 lines
Diff to previous 1.94 (colored)

Next round of config cleanup. Move various lists into the bgpd_config struct.
This is the next step to better split parsing and merging the config.
OK benno@

Revision 1.94 / (download) - annotate - [select for diffs], Sat Apr 25 15:28:18 2015 UTC (10 years, 5 months ago) by phessler
Branch: MAIN
Changes since 1.93: +3 -1 lines
Diff to previous 1.93 (colored)

allow us to write rules that match directly on the peer AS

...
allow from AS 1 prefix 192.0.2.0/24
...

Also adjust the IRR ruleset output to include the declared peer AS,
instead of hoping they listed their neighbor IP address!


OK benno@
older version OK: claudio@ henning@

Revision 1.93 / (download) - annotate - [select for diffs], Wed Nov 13 09:14:48 2013 UTC (11 years, 10 months ago) by florian
Branch: MAIN
CVS Tags: OPENBSD_5_7_BASE, OPENBSD_5_7, OPENBSD_5_6_BASE, OPENBSD_5_6, OPENBSD_5_5_BASE, OPENBSD_5_5
Changes since 1.92: +2 -1 lines
Diff to previous 1.92 (colored)

Knob to set priority with which bgpd inserts routes into the kernel
routing table. Need for it in "special" setups pointed out by
Loic Blot (loic.blot _AT_ unix-experience _DOT_ fr) on tech.
OK benno, henning

Revision 1.92 / (download) - annotate - [select for diffs], Wed Oct 30 17:28:33 2013 UTC (11 years, 10 months ago) by deraadt
Branch: MAIN
Changes since 1.91: +5 -5 lines
Diff to previous 1.91 (colored)

use more careful format strings to deal with various forms of AS#'s
ok claudio benno

Revision 1.91 / (download) - annotate - [select for diffs], Sat Oct 19 15:04:25 2013 UTC (11 years, 11 months ago) by claudio
Branch: MAIN
Changes since 1.90: +9 -16 lines
Diff to previous 1.90 (colored)

Merge the prefix and prefixlen filter bits into one filter. Change the
filter expansion so that rules are grouped by prefixes last. The RDE will
then be able to optimize the rules into table lookups but that is a later
step. As additional goodies it is now possible to use inet and inet6
on their own and or-longer can be used as a shorthand for prefixlen >= len.
OK henning@ sthen@ florian@

Revision 1.90 / (download) - annotate - [select for diffs], Thu Jan 17 02:00:33 2013 UTC (12 years, 8 months ago) by claudio
Branch: MAIN
CVS Tags: OPENBSD_5_4_BASE, OPENBSD_5_4, OPENBSD_5_3_BASE, OPENBSD_5_3
Changes since 1.89: +15 -8 lines
Diff to previous 1.89 (colored)

Fixup printing of rdomain configs -- add network statements and only print
the description if it is set.

Revision 1.89 / (download) - annotate - [select for diffs], Tue Nov 13 09:47:20 2012 UTC (12 years, 10 months ago) by claudio
Branch: MAIN
Changes since 1.88: +8 -1 lines
Diff to previous 1.88 (colored)

Allow filtering based on the NEXTHOP attribute. This allows to build rules
like: allow from any nexthop neighbor (to allow only prefixes that use the
routers IP address as nexthop). Lots of testing, input and OK florian@

Revision 1.88 / (download) - annotate - [select for diffs], Sun Sep 23 09:39:18 2012 UTC (13 years ago) by claudio
Branch: MAIN
Changes since 1.87: +3 -3 lines
Diff to previous 1.87 (colored)

Enable graceful restart by default. The only way to find out if it works for
real. After discussion with sthen@, henning@ and deraadt@.
It can be disabled per neighbor with "announce restart no".

Revision 1.87 / (download) - annotate - [select for diffs], Wed Sep 12 05:56:22 2012 UTC (13 years ago) by claudio
Branch: MAIN
Changes since 1.86: +2 -2 lines
Diff to previous 1.86 (colored)

Better graceful restart support (implementing more then just the EoR record).
This implements only the "Restarting Client" bits of the RFC -- in other
words bgpd will keep the FIB when the client restarts but it will not do GR
when restarting itself. The capability is still off by default (you need
"announce restart yes" to enable it).
Tested by Anders Berggren. OK sthen@

Revision 1.86 / (download) - annotate - [select for diffs], Sat Sep 17 16:29:44 2011 UTC (14 years ago) by claudio
Branch: MAIN
CVS Tags: OPENBSD_5_2_BASE, OPENBSD_5_2, OPENBSD_5_1_BASE, OPENBSD_5_1
Changes since 1.85: +7 -6 lines
Diff to previous 1.85 (colored)

Implement new mrt table dump format as specified in draft-ietf-grow-mrt.
Tested with IP and IPv6 sessions and against the libbgpdump parser.
OK henning@

Revision 1.85 / (download) - annotate - [select for diffs], Fri Dec 31 21:22:42 2010 UTC (14 years, 8 months ago) by guenther
Branch: MAIN
CVS Tags: OPENBSD_5_0_BASE, OPENBSD_5_0, OPENBSD_4_9_BASE, OPENBSD_4_9
Changes since 1.84: +2 -1 lines
Diff to previous 1.84 (colored)

Add missing #includes instead of assuming that some system header pulls in
the needed bits

ok deraadt@, millert@

Revision 1.84 / (download) - annotate - [select for diffs], Fri Aug 6 14:32:13 2010 UTC (15 years, 1 month ago) by jsg
Branch: MAIN
CVS Tags: OPENBSD_4_8_BASE, OPENBSD_4_8
Changes since 1.83: +2 -2 lines
Diff to previous 1.83 (colored)

Correct a problem which could cause the wrong af to be displayed.
Found via the clang static analyser.
ok henning@ claudio@ deraadt@

Revision 1.83 / (download) - annotate - [select for diffs], Sun Jun 27 19:53:34 2010 UTC (15 years, 3 months ago) by claudio
Branch: MAIN
Changes since 1.82: +5 -1 lines
Diff to previous 1.82 (colored)

Instead of specifying the control sockets on the command line have them
in bgpd.conf. This allows to add/modify restricted control sockets on runtime.
Feature request by a few people how often forgot to add -r path when restarting
bgpd (including myself).
NOTE: this removes the -s and -r arguments from bgpd so pay attention when
updateing.
jajaja sthen@, OK henning@

Revision 1.82 / (download) - annotate - [select for diffs], Mon May 17 16:08:20 2010 UTC (15 years, 4 months ago) by claudio
Branch: MAIN
Changes since 1.81: +6 -1 lines
Diff to previous 1.81 (colored)

Implement two new filters, max-as-len and max-as-seq. The first is limiting
the length of an AS path (matches if the path is longer then the specified
lenght) the second matches when a sequence of the same AS number is longer
then the specified length).
max-as-len is good to protect crappy comercial bgp boxes from other crappy
comercial bgp boxes. max-as-seq was a feature request from SwissIX and maybe
EuroIX to find and filter prepends.
Additinal testing and OK sthen@

Revision 1.81 / (download) - annotate - [select for diffs], Mon May 17 15:49:29 2010 UTC (15 years, 4 months ago) by claudio
Branch: MAIN
Changes since 1.80: +66 -35 lines
Diff to previous 1.80 (colored)

Last bits of MPLS VPN support. Hook kernel routing tables and RIB together.
This adds a bit of new config to specify the mapping between an rdomain and
the BGP MPLS VPN instance, example:
rdomain 1 {
        descr "CUSTOMER1"
	rd 65003:1
	import-target rt 65003:3
	export-target rt 65003:1
	depend on mpe0
	network 192.168.224/24
}
The "depend on mpe0" is a but ugly but for now this is the quickest way to
figure out which interface bgp should use to insert the MPLS routes.

A big side-effect of this diff is that networks are now internally
distributed through kroute.c.
This needs some kernel changes that will follow hopefully soon.
OK henning@

Revision 1.80 / (download) - annotate - [select for diffs], Mon May 3 13:09:38 2010 UTC (15 years, 4 months ago) by claudio
Branch: MAIN
Changes since 1.79: +6 -7 lines
Diff to previous 1.79 (colored)

Make it possible to load multiple routing tables at the same time and use
those for alternate RIBs. This allows to use "rde rib TESTIT rtable 1".
NOTE: nexthop verification has changed for alternate tables. For now
nexthop will only be verified against the main routing table (id 0).
Because of this "nexthop qualify via bgp" may now compare the nexthops
against bgpd routes from a different RIB.
Tested by sthen@, OK to move on by henning@

Revision 1.79 / (download) - annotate - [select for diffs], Fri Mar 5 15:25:00 2010 UTC (15 years, 6 months ago) by claudio
Branch: MAIN
CVS Tags: OPENBSD_4_7_BASE, OPENBSD_4_7
Changes since 1.78: +10 -8 lines
Diff to previous 1.78 (colored)

Allow to filter for ext-community attributes. Currently only perfect matches
work but that's already better then nothing. OK sthen@

Revision 1.78 / (download) - annotate - [select for diffs], Wed Mar 3 22:09:08 2010 UTC (15 years, 6 months ago) by claudio
Branch: MAIN
Changes since 1.77: +2 -2 lines
Diff to previous 1.77 (colored)

Compare against correct flag when printing "network inet6 static"

Revision 1.77 / (download) - annotate - [select for diffs], Thu Dec 17 09:32:59 2009 UTC (15 years, 9 months ago) by claudio
Branch: MAIN
Changes since 1.76: +2 -2 lines
Diff to previous 1.76 (colored)

Fix formatstring in printf.

Revision 1.76 / (download) - annotate - [select for diffs], Wed Dec 16 15:40:55 2009 UTC (15 years, 9 months ago) by claudio
Branch: MAIN
Changes since 1.75: +38 -1 lines
Diff to previous 1.75 (colored)

Implement "set ext-community [delete] subtype key:value" to set and delete
extended communities as specified in RFC 4360. No matching implemented yet
and stuff like * and neighbor-as are neither supported but will be soon.
Looks good henning & sthen, manpage fixed by jmc

Revision 1.75 / (download) - annotate - [select for diffs], Tue Dec 8 14:03:40 2009 UTC (15 years, 9 months ago) by claudio
Branch: MAIN
Changes since 1.74: +10 -14 lines
Diff to previous 1.74 (colored)

Big AID change part two. This changes the mp capability into an array of
flags. This makes a lot of code much easier since the comparison is now
trivial. Additionally calculate the negotiated capabilities for a session
in the SE and pass that and only that to the RDE. This makes the decisions
in the RDE a lot easier.  OK henning@

Revision 1.74 / (download) - annotate - [select for diffs], Tue Dec 1 14:28:05 2009 UTC (15 years, 9 months ago) by claudio
Branch: MAIN
Changes since 1.73: +8 -8 lines
Diff to previous 1.73 (colored)

Use an artificial address family id in struct bgpd_addr and almost everywhere
else. Adds conversion functions to map AFI/SAFI and the Unix AF_ values
from and into AID used in bgpd.  This is needed to support things like MPLS
VPN and other upcomming changes that need to play a lot with AFI/SAFI pairs.
Mostly mechanical change, henning@ has no particular issues with this.
Must go in so that I can continue working.

Revision 1.73 / (download) - annotate - [select for diffs], Thu Nov 26 13:40:43 2009 UTC (15 years, 10 months ago) by henning
Branch: MAIN
Changes since 1.72: +19 -1 lines
Diff to previous 1.72 (colored)

support for set origin; based on an initial diff from
Sebastian Benoit <benoit-lists at fb12 dot de> who also tested this version
claudio ok

Revision 1.72 / (download) - annotate - [select for diffs], Tue Oct 13 11:41:32 2009 UTC (15 years, 11 months ago) by claudio
Branch: MAIN
Changes since 1.71: +3 -3 lines
Diff to previous 1.71 (colored)

Forgot this bit when disableing restart capability.

Revision 1.71 / (download) - annotate - [select for diffs], Tue Oct 6 09:44:13 2009 UTC (15 years, 11 months ago) by claudio
Branch: MAIN
Changes since 1.70: +7 -1 lines
Diff to previous 1.70 (colored)

Add config knobs to enable/disable individual BGP capabilities per neighbor.
e.g. announce refresh no. With this be more aggressive when announcing our
capabilities and enable all of them by default. If there are troubles with
some neighbors adding the following config lines should bring you back
to the old behaviour:
announce refresh yes # was already on by default
announce restart no
announce as-4byte no # was only set on sessions to peers with 4byte AS nums
OK henning and sthen

Revision 1.70 / (download) - annotate - [select for diffs], Sat Jun 6 01:10:29 2009 UTC (16 years, 3 months ago) by claudio
Branch: MAIN
CVS Tags: OPENBSD_4_6_BASE, OPENBSD_4_6
Changes since 1.69: +4 -2 lines
Diff to previous 1.69 (colored)

Some preliminary filter magic to support multiple RIBs on the filters.
It is ugly but does the trick for now. Filters will be rewritten anyway.
The rib specifier only makes sense on from rules. e.g. deny rib OMG from any

Revision 1.69 / (download) - annotate - [select for diffs], Fri Jun 5 20:26:38 2009 UTC (16 years, 3 months ago) by claudio
Branch: MAIN
Changes since 1.68: +21 -7 lines
Diff to previous 1.68 (colored)

Adjust print_config to all the stuff added in the last days.

Revision 1.68 / (download) - annotate - [select for diffs], Wed May 27 04:18:21 2009 UTC (16 years, 4 months ago) by reyk
Branch: MAIN
Changes since 1.67: +3 -1 lines
Diff to previous 1.67 (colored)

add an option to change the "connect-retry" timer which defaults to 120s.
this can be used to decrease the failover time in specific carp'ed
IBGP setups.

ok henning@

Revision 1.67 / (download) - annotate - [select for diffs], Thu Mar 26 13:59:30 2009 UTC (16 years, 6 months ago) by henning
Branch: MAIN
Changes since 1.66: +2 -2 lines
Diff to previous 1.66 (colored)

argh, do not reuse the global trans_as flag to be applied to the peer
specific or we had to widen the peer specific flags without need.
defien PERRFLAG_TRANS_AS instead and use that

Revision 1.66 / (download) - annotate - [select for diffs], Sun Mar 22 22:35:00 2009 UTC (16 years, 6 months ago) by henning
Branch: MAIN
Changes since 1.65: +3 -4 lines
Diff to previous 1.65 (colored)

make transparent-as yes|no settable peer neighbor with the global setting
acting as default.
per-neighbor requested by arnold nipper @ decix, ok claudio

Revision 1.65 / (download) - annotate - [select for diffs], Thu Nov 22 11:37:25 2007 UTC (17 years, 10 months ago) by henning
Branch: MAIN
CVS Tags: OPENBSD_4_5_BASE, OPENBSD_4_5, OPENBSD_4_4_BASE, OPENBSD_4_4, OPENBSD_4_3_BASE, OPENBSD_4_3
Changes since 1.64: +3 -1 lines
Diff to previous 1.64 (colored)

add "demote", was missing. noticed by camield@

Revision 1.64 / (download) - annotate - [select for diffs], Mon May 28 17:26:33 2007 UTC (18 years, 4 months ago) by henning
Branch: MAIN
CVS Tags: OPENBSD_4_2_BASE, OPENBSD_4_2
Changes since 1.63: +2 -2 lines
Diff to previous 1.63 (colored)

allow matching on communities using 0 in the AS part, that is in use.
that unfortunately means we cannot use 0 for "unset".
ok claudio

Revision 1.63 / (download) - annotate - [select for diffs], Tue May 15 11:07:46 2007 UTC (18 years, 4 months ago) by henning
Branch: MAIN
Changes since 1.62: +3 -1 lines
Diff to previous 1.62 (colored)

printconf didn't handle the 'down' flag for peers
From: Stuart Henderson <[email protected]>

Revision 1.62 / (download) - annotate - [select for diffs], Mon Apr 23 13:04:24 2007 UTC (18 years, 5 months ago) by claudio
Branch: MAIN
Changes since 1.61: +11 -9 lines
Diff to previous 1.61 (colored)

Make bgpd 4-byte AS compatible. All internal representations of AS numbers
are now 4-byte instead of the old 2-byte numbers. The only exception are
communities because they can not be switched. The RDE will inflate and deflate
the ASPATH and AGGREGATOR attributes on demand and create the NEW_ASPATH and
NEW_AGGREGATOR field whenever needed. Both old and new stile sessions are
supported and can be mixed. Currently new stile sessions with the 4-byte AS
number capability turned on are only enabled if one of the AS numbers involved
is a 4-byte one.
This is based on an initial diff by Geoff Huston gih (at) apnic (dot) net
Cleanup, testing and bug-fixes by myself (via AS 3.10).
Currently mrt table dumps are producing incompatible output this will be fixed
afterwards -- this diff is already big enough.

"get it in if you think it is ready" henning@

Revision 1.61 / (download) - annotate - [select for diffs], Thu Mar 29 13:09:26 2007 UTC (18 years, 6 months ago) by claudio
Branch: MAIN
Changes since 1.60: +8 -1 lines
Diff to previous 1.60 (colored)

Until now prefixlen defaulted to AF_INET if it was used without a prefix.
This makes prefixlen filtering for AF_INET6 unnecessary complex. From now
on if prefixlen is used alone the address family needs to be specified
beforehands via the new inet or inet6 keywords.
Remove an old check so that it is finally possible to filter IPv6 prefixes.
OK henning@

Revision 1.60 / (download) - annotate - [select for diffs], Tue Mar 6 16:52:48 2007 UTC (18 years, 6 months ago) by henning
Branch: MAIN
CVS Tags: OPENBSD_4_1_BASE, OPENBSD_4_1
Changes since 1.59: +3 -1 lines
Diff to previous 1.59 (colored)

allow filtering on peer-as (leftmost AS in path), ok claudio

Revision 1.59 / (download) - annotate - [select for diffs], Tue Dec 5 12:08:13 2006 UTC (18 years, 9 months ago) by henning
Branch: MAIN
Changes since 1.58: +4 -1 lines
Diff to previous 1.58 (colored)

implement the ttl security hack. since the pc slaves fear the word hack,
they call it "Generalized TTL Security Mechanism" officially, RFC 3682.
manpage with help from jmc

Revision 1.58 / (download) - annotate - [select for diffs], Tue Nov 28 16:39:34 2006 UTC (18 years, 10 months ago) by henning
Branch: MAIN
Changes since 1.57: +3 -1 lines
Diff to previous 1.57 (colored)

allow bgpd to work on alternate routing tables, claudio ok, jmc manpage help

Revision 1.57 / (download) - annotate - [select for diffs], Fri Aug 4 12:01:48 2006 UTC (19 years, 1 month ago) by henning
Branch: MAIN
CVS Tags: OPENBSD_4_0_BASE, OPENBSD_4_0
Changes since 1.56: +7 -3 lines
Diff to previous 1.56 (colored)

add "restart" to max-prefix, allows sessions suspended due to reaching
max-prefix to be restarted automagically after a given number of minutes
requested by "Sylwester S. Biernacki" <[email protected]>, manpage help jmc,
ok claudio

Revision 1.56 / (download) - annotate - [select for diffs], Sat May 27 15:37:29 2006 UTC (19 years, 4 months ago) by claudio
Branch: MAIN
Changes since 1.55: +29 -17 lines
Diff to previous 1.55 (colored)

Move prinitng of communities into own function so that special communities
like "*" or "neighbor-as" is printed correctly. Issue noticed by Leen Besselink.

Revision 1.55 / (download) - annotate - [select for diffs], Tue Apr 4 12:03:26 2006 UTC (19 years, 5 months ago) by henning
Branch: MAIN
Changes since 1.54: +4 -1 lines
Diff to previous 1.54 (colored)

add "set nexthop self", force nexthop to be set to own address even with IBGP
requested & tested Falk Brockerhoff <[email protected]>, and tony sarendal
tested this too. claudio ok

Revision 1.54 / (download) - annotate - [select for diffs], Wed Mar 22 13:30:35 2006 UTC (19 years, 6 months ago) by claudio
Branch: MAIN
Changes since 1.53: +6 -1 lines
Diff to previous 1.53 (colored)

Change the way bgpd selects nexthops. Up until now every route was considered
when calculating the nexthop. Now only non BGP routes and not the default
route are used unless forced with the new config options
 nexthop qualify via bgp
 nexthop qualify via default
This change is required for complex setups e.g. where an additional IGP is
running.  OK henning@

Revision 1.53 / (download) - annotate - [select for diffs], Fri Feb 10 14:34:40 2006 UTC (19 years, 7 months ago) by claudio
Branch: MAIN
CVS Tags: OPENBSD_3_9_BASE, OPENBSD_3_9
Changes since 1.52: +12 -1 lines
Diff to previous 1.52 (colored)

Make it possible to turn suftreconfig in/out on or off. Default is on for
both directions. Manpage update follows. OK henning@

Revision 1.52 / (download) - annotate - [select for diffs], Thu Feb 9 21:05:09 2006 UTC (19 years, 7 months ago) by claudio
Branch: MAIN
Changes since 1.51: +5 -1 lines
Diff to previous 1.51 (colored)

Implement "set community delete 65001:*" and friends. This will remove
communities from the path attributes. Useful to make sure that the ones you
set later are set by a (evil) peer.  OK henning@

Revision 1.51 / (download) - annotate - [select for diffs], Thu Feb 2 14:06:05 2006 UTC (19 years, 7 months ago) by claudio
Branch: MAIN
Changes since 1.50: +6 -1 lines
Diff to previous 1.50 (colored)

Implement new special community "neighbor-as". neighbor-as is expanded on
the fly to the remote AS of the current neighbor. This can be used to
simplify rulesets in a dramatic way -- going from a script based nightmare
down to a handfull rules. jajajaja henning@

Revision 1.50 / (download) - annotate - [select for diffs], Tue Nov 1 10:58:29 2005 UTC (19 years, 10 months ago) by claudio
Branch: MAIN
Changes since 1.49: +1 -7 lines
Diff to previous 1.49 (colored)

Switch from the per peer filter set list to a filter-only solution.
The default filter_sets are converted into match filter rules that get
evaluated first. Simplifies code massively -- mainly the config reload
part -- and makes softreconfig out a piece of cake.  "get it in" henning@

Revision 1.49 / (download) - annotate - [select for diffs], Mon Oct 31 17:00:05 2005 UTC (19 years, 10 months ago) by claudio
Branch: MAIN
Changes since 1.48: +2 -2 lines
Diff to previous 1.48 (colored)

Missing space in printf for unknown peers.

Revision 1.48 / (download) - annotate - [select for diffs], Mon Oct 31 16:31:39 2005 UTC (19 years, 10 months ago) by claudio
Branch: MAIN
Changes since 1.47: +2 -2 lines
Diff to previous 1.47 (colored)

Print group names in rules in double quotes. Makes the output more parsable.

Revision 1.47 / (download) - annotate - [select for diffs], Tue Aug 9 20:27:25 2005 UTC (20 years, 1 month ago) by claudio
Branch: MAIN
CVS Tags: OPENBSD_3_8_BASE, OPENBSD_3_8
Changes since 1.46: +4 -1 lines
Diff to previous 1.46 (colored)

Introduce new route decision tunable "rde med compare (always|strict)".
If set to always the med will also be compared between different AS.
The default is strict which is the way the RFC specifies it.
OK henning@

Revision 1.46 / (download) - annotate - [select for diffs], Thu Jul 28 20:14:29 2005 UTC (20 years, 2 months ago) by henning
Branch: MAIN
Changes since 1.45: +18 -1 lines
Diff to previous 1.45 (colored)

print the v4/v6 safi announce stuff, from wth

Revision 1.45 / (download) - annotate - [select for diffs], Fri Jul 1 13:38:14 2005 UTC (20 years, 2 months ago) by claudio
Branch: MAIN
Changes since 1.44: +10 -10 lines
Diff to previous 1.44 (colored)

Switch filter_sets form SIMPLEQ to TAILQ, needed for upcomming stuff.

Revision 1.44 / (download) - annotate - [select for diffs], Fri Jul 1 09:19:24 2005 UTC (20 years, 2 months ago) by claudio
Branch: MAIN
Changes since 1.43: +3 -2 lines
Diff to previous 1.43 (colored)

Make the pftable filter set use the name2id "cache" like the route labels.
This saves 14 bytes per aspath. OK henning@

Revision 1.43 / (download) - annotate - [select for diffs], Wed Jun 29 09:43:25 2005 UTC (20 years, 3 months ago) by claudio
Branch: MAIN
Changes since 1.42: +8 -1 lines
Diff to previous 1.42 (colored)

rtlabel support via filter sets. Just use "set rtlabel foobar" in filters
network and neighbor statements and the routes are labeled accordingly.
While doing that fix some mem-leaks by introducing filterset_free() and
remove the free on send option of send_filterset().
This took a bit longer because we need to carefully track the rtlabel id
refcnts or bad things may happen on reloads.
henning@ looks fine

Revision 1.42 / (download) - annotate - [select for diffs], Thu Jun 9 15:32:03 2005 UTC (20 years, 3 months ago) by claudio
Branch: MAIN
Changes since 1.41: +17 -3 lines
Diff to previous 1.41 (colored)

Change the "network connected|static" statements to "network inet|inet6
connected|static" so that it is possible to distinguish between IPv4 and IPv6
addresses. "network connected|static" is considered deprecated but will be
supported as an alias for "network inet connected|static" for some time (one
release) to simplify upgrades. This also solve a nasty crash when using
"network connected".  OK henning@

Revision 1.41 / (download) - annotate - [select for diffs], Thu Apr 28 13:54:45 2005 UTC (20 years, 5 months ago) by claudio
Branch: MAIN
Changes since 1.40: +16 -1 lines
Diff to previous 1.40 (colored)

Support for "network connected" and "network static" -- announce all
directly connected respectively all static routes. The list is auto-
matically adjusted as soon as a route changes.
OK henning@

Revision 1.40 / (download) - annotate - [select for diffs], Mon Apr 18 11:00:42 2005 UTC (20 years, 5 months ago) by claudio
Branch: MAIN
Changes since 1.39: +3 -3 lines
Diff to previous 1.39 (colored)

Print mrt config after the main and network config. Main and network config
belong together. OK henning@

Revision 1.39 / (download) - annotate - [select for diffs], Tue Apr 12 14:32:00 2005 UTC (20 years, 5 months ago) by claudio
Branch: MAIN
Changes since 1.38: +7 -1 lines
Diff to previous 1.38 (colored)

Introduce a per prefix weight.  The weight is used to tip prefixes with equal
long AS pathes in one or the other direction.  It weights a prefix at a very
late stage in the decision process. This is a nice bgpd feature to traffic
engineer networks where most AS pathes are equally long.
OK henning@

Revision 1.38 / (download) - annotate - [select for diffs], Thu Apr 7 23:45:21 2005 UTC (20 years, 5 months ago) by henning
Branch: MAIN
Changes since 1.37: +2 -1 lines
Diff to previous 1.37 (colored)

nicer output

Revision 1.37 / (download) - annotate - [select for diffs], Mon Mar 14 17:32:04 2005 UTC (20 years, 6 months ago) by claudio
Branch: MAIN
CVS Tags: OPENBSD_3_7_BASE, OPENBSD_3_7
Changes since 1.36: +7 -1 lines
Diff to previous 1.36 (colored)

Allow to modify the metrics in a relative way by prepending the number with
a '+' or '-'. e.g. set localpref +20. This is another gem from the FOSDEM
lying around on my HD gathering dust. OK henning@

Revision 1.36 / (download) - annotate - [select for diffs], Fri Mar 11 12:54:19 2005 UTC (20 years, 6 months ago) by claudio
Branch: MAIN
Changes since 1.35: +7 -1 lines
Diff to previous 1.35 (colored)

Finally commit the transparent-as and nexthop no-modify stuff I wrote on the
way to FOSDEM. With transparent-as set to ye bgpd will not prepend his own
AS for sent updates. NB the neighbor needs to set "enforce neighbor-as no"
or it will not like the received AS paths. With set nexthop no-modify bgpd
will change the nexthop as done normaly.
OK henning@ man page update with help of jmc@

Revision 1.35 / (download) - annotate - [select for diffs], Tue Nov 23 13:07:01 2004 UTC (20 years, 10 months ago) by claudio
Branch: MAIN
Changes since 1.34: +42 -21 lines
Diff to previous 1.34 (colored)

Switch from a single filter_set to a linked list of sets. With this change
it is possible to specify multiple communities. This is also the first step
to better bgpd filters. OK henning@

Revision 1.34 / (download) - annotate - [select for diffs], Thu Nov 18 17:07:38 2004 UTC (20 years, 10 months ago) by henning
Branch: MAIN
Changes since 1.33: +2 -2 lines
Diff to previous 1.33 (colored)

add an instance of struct capabilities to peer_conf, and inherit
peer->capa.ann from this

Revision 1.33 / (download) - annotate - [select for diffs], Thu Nov 11 10:35:15 2004 UTC (20 years, 10 months ago) by claudio
Branch: MAIN
Changes since 1.32: +4 -1 lines
Diff to previous 1.32 (colored)

New config statement "rde route-age [evaluate|ignore]". If set to evaluate
the best path selection will not only be based on the path attributes but
also on the age of the prefix. This is an extension to the RFC. The default
is ignore but previously it was implicitly set to evaluate.
OK henning@ man page OK jaredy@ jmc@

Revision 1.32 / (download) - annotate - [select for diffs], Tue Oct 19 14:53:14 2004 UTC (20 years, 11 months ago) by henning
Branch: MAIN
Changes since 1.31: +72 -23 lines
Diff to previous 1.31 (colored)

fix printing of groups - instead of surrounding each neighbor statement
which is part of a group by "group blah { .. }", so that each group decl
occurs multiple times (that is valid, but confusing and ugly), stuff
pointers to each peer into an a array and sort it based on group id.
then print all neighbors whoch are not part of a group followed
by each group with all its members.
annoyed me for quite some time, now finally enough to sit down and fix it
claudio ok

Revision 1.31 / (download) - annotate - [select for diffs], Tue Oct 19 12:02:50 2004 UTC (20 years, 11 months ago) by henning
Branch: MAIN
Changes since 1.30: +3 -1 lines
Diff to previous 1.30 (colored)

allow neighbor definitions to depend on interface state.
with this, if a neighbor is configured as dependent on carp0 for example,
the neighbor will remain in state IDLE as long as carp0 is not master.
once carp0 becomes master the session(s) depending on it immediately
go to CONNECT (or ACTIVE, if they're configured passive), reducing failover
time. claudio ok, with some input from ryan as well

Revision 1.30 / (download) - annotate - [select for diffs], Tue Sep 28 12:09:31 2004 UTC (21 years ago) by claudio
Branch: MAIN
Changes since 1.29: +5 -3 lines
Diff to previous 1.29 (colored)

Add prepend-neighbor feature. Prepend the remote-as n times similar to
prepend-self. Only for incomming UPDATEs. OK henning@

Revision 1.29 / (download) - annotate - [select for diffs], Tue Aug 24 15:50:16 2004 UTC (21 years, 1 month ago) by claudio
Branch: MAIN
CVS Tags: OPENBSD_3_6_BASE, OPENBSD_3_6
Changes since 1.28: +18 -4 lines
Diff to previous 1.28 (colored)

Add missing config statements -- route-reflector and enforce neighbor-as.
Now printconf is in sync with the man page. OK henning@

Revision 1.28 / (download) - annotate - [select for diffs], Tue Aug 24 12:42:55 2004 UTC (21 years, 1 month ago) by claudio
Branch: MAIN
Changes since 1.27: +4 -4 lines
Diff to previous 1.27 (colored)

Forgot to update printconf.c once again. foobar-AS is now foobar-as.

Revision 1.27 / (download) - annotate - [select for diffs], Fri Aug 13 14:03:20 2004 UTC (21 years, 1 month ago) by claudio
Branch: MAIN
Changes since 1.26: +4 -2 lines
Diff to previous 1.26 (colored)

Fix minor issues with IPv6 dumps and add a function for dumping the RIB table
protocol independent. This new dump format is not (yet) supported by the
mrtd route_btoa tool. OK henning@

Revision 1.26 / (download) - annotate - [select for diffs], Tue Aug 10 13:02:08 2004 UTC (21 years, 1 month ago) by claudio
Branch: MAIN
Changes since 1.25: +2 -2 lines
Diff to previous 1.25 (colored)

switch nexthop in struct filter_set form struct in_addr to struct bgpd_addr
OK henning@

Revision 1.25 / (download) - annotate - [select for diffs], Mon Aug 2 12:30:15 2004 UTC (21 years, 1 month ago) by claudio
Branch: MAIN
Changes since 1.24: +3 -1 lines
Diff to previous 1.24 (colored)

Forgot to add "anounce default-route" here. OK henning@

Revision 1.24 / (download) - annotate - [select for diffs], Mon Jul 5 16:54:53 2004 UTC (21 years, 2 months ago) by henning
Branch: MAIN
Changes since 1.23: +5 -1 lines
Diff to previous 1.23 (colored)

implement "set nexthop blackhole" and "set nexthop reject"
blackhole/reject routes will be entered to the kernel for matching ones.
this is intended to be used with the Cymru Bogon Route Server Project
(http://www.cymru.com/BGP/bogon-rs.html) and similar services, claudio ok

Revision 1.23 / (download) - annotate - [select for diffs], Sat Jul 3 17:19:59 2004 UTC (21 years, 2 months ago) by claudio
Branch: MAIN
Changes since 1.22: +9 -8 lines
Diff to previous 1.22 (colored)

Switch mrt dumping to fd passing. This gives some speed up when extensive
dumping is done. Acctually mrt dumps were broken because of the fd passing.
The nice side effect is a much cleaner code, especially in the parent process.
OK henning@

Revision 1.22 / (download) - annotate - [select for diffs], Sun Jun 20 18:35:12 2004 UTC (21 years, 3 months ago) by henning
Branch: MAIN
Changes since 1.21: +3 -3 lines
Diff to previous 1.21 (colored)

at least somewhat consistently name the TAILQ_ENTRYs... this confused me
more than once

Revision 1.21 / (download) - annotate - [select for diffs], Sun Jun 6 17:38:10 2004 UTC (21 years, 3 months ago) by henning
Branch: MAIN
Changes since 1.20: +5 -9 lines
Diff to previous 1.20 (colored)

rework bgpd's handling of listening sockets. instead of one for each
supported address familiy, keep a tailq of an arbitary number of them.
the new struct listen_addr contains the sockaddr and the fd.
this fixes quite some nasty behaviour which was a consequence of the previous
model.
looks right deraadt@, and discussed with claudio

Revision 1.20 / (download) - annotate - [select for diffs], Sat May 8 19:17:20 2004 UTC (21 years, 4 months ago) by henning
Branch: MAIN
Changes since 1.19: +9 -7 lines
Diff to previous 1.19 (colored)

KNF

Revision 1.19 / (download) - annotate - [select for diffs], Sat May 8 18:23:24 2004 UTC (21 years, 4 months ago) by henning
Branch: MAIN
Changes since 1.18: +8 -2 lines
Diff to previous 1.18 (colored)

do not omit the IPv6 listening address

Revision 1.18 / (download) - annotate - [select for diffs], Sat May 8 17:40:53 2004 UTC (21 years, 4 months ago) by henning
Branch: MAIN
Changes since 1.17: +10 -4 lines
Diff to previous 1.17 (colored)

add support for ipsec ah with manual keys, pfkey part already does so, and
flesh parser out a bit. also add support for printing ipsec ah with manual
keys in printconf

Revision 1.17 / (download) - annotate - [select for diffs], Wed Apr 28 04:34:46 2004 UTC (21 years, 5 months ago) by henning
Branch: MAIN
Changes since 1.16: +5 -3 lines
Diff to previous 1.16 (colored)

allow ah/esp spec with IKE, markus ok

Revision 1.16 / (download) - annotate - [select for diffs], Wed Apr 28 00:38:39 2004 UTC (21 years, 5 months ago) by henning
Branch: MAIN
Changes since 1.15: +4 -4 lines
Diff to previous 1.15 (colored)

prefix the auth related defines by AUTH_, we had a name clash, markus ok

Revision 1.15 / (download) - annotate - [select for diffs], Tue Apr 27 23:20:42 2004 UTC (21 years, 5 months ago) by henning
Branch: MAIN
Changes since 1.14: +45 -1 lines
Diff to previous 1.14 (colored)

teach printconf about all this shiny new ipsec stuff

Revision 1.14 / (download) - annotate - [select for diffs], Tue Apr 27 22:42:13 2004 UTC (21 years, 5 months ago) by henning
Branch: MAIN
Changes since 1.13: +2 -2 lines
Diff to previous 1.13 (colored)

rename the ipsec struct to auth, move all tcpmd5 related fields in there, and
add a generic "method" field that expresses what method
(none/md5sig/ipsec manual/ipsec ike) is in use
markus ok

Revision 1.13 / (download) - annotate - [select for diffs], Mon Apr 26 04:40:11 2004 UTC (21 years, 5 months ago) by henning
Branch: MAIN
Changes since 1.12: +9 -3 lines
Diff to previous 1.12 (colored)

fix printing template neighbors

Revision 1.12 / (download) - annotate - [select for diffs], Wed Mar 17 12:40:38 2004 UTC (21 years, 6 months ago) by claudio
Branch: MAIN
CVS Tags: OPENBSD_3_5_BASE, OPENBSD_3_5
Changes since 1.11: +3 -1 lines
Diff to previous 1.11 (colored)

Add missing space for sets in network statements.

Revision 1.11 / (download) - annotate - [select for diffs], Fri Mar 12 20:57:22 2004 UTC (21 years, 6 months ago) by henning
Branch: MAIN
Changes since 1.10: +3 -1 lines
Diff to previous 1.10 (colored)

print that capabilities stuff

Revision 1.10 / (download) - annotate - [select for diffs], Thu Mar 11 17:34:01 2004 UTC (21 years, 6 months ago) by henning
Branch: MAIN
Changes since 1.9: +2 -2 lines
Diff to previous 1.9 (colored)

KNF

Revision 1.9 / (download) - annotate - [select for diffs], Thu Mar 11 17:12:51 2004 UTC (21 years, 6 months ago) by claudio
Branch: MAIN
Changes since 1.8: +13 -1 lines
Diff to previous 1.8 (colored)

Add basic support for communities. Currently it is only possible to filter
on communities, e.g match from any community 24640:* set localpref 666
OK henning@

Revision 1.8 / (download) - annotate - [select for diffs], Mon Mar 1 23:00:03 2004 UTC (21 years, 6 months ago) by henning
Branch: MAIN
Changes since 1.7: +3 -2 lines
Diff to previous 1.7 (colored)

don't print empty descr

Revision 1.7 / (download) - annotate - [select for diffs], Mon Mar 1 17:04:07 2004 UTC (21 years, 6 months ago) by henning
Branch: MAIN
Changes since 1.6: +2 -2 lines
Diff to previous 1.6 (colored)

KNF

Revision 1.6 / (download) - annotate - [select for diffs], Mon Mar 1 16:47:06 2004 UTC (21 years, 6 months ago) by claudio
Branch: MAIN
Changes since 1.5: +83 -29 lines
Diff to previous 1.5 (colored)

Sync printconfig.c with parse.y. OK henning@

Revision 1.5 / (download) - annotate - [select for diffs], Tue Feb 24 15:43:03 2004 UTC (21 years, 7 months ago) by claudio
Branch: MAIN
Changes since 1.4: +27 -5 lines
Diff to previous 1.4 (colored)

Enhance filters. prefixlen knows now 8-24 and 8><24. It is possible to use
prefix 10.0.0.0/8 prefixlen >= 8 and set localpref 100 can be set on a per
neighbor basis. OK henning@

Revision 1.4 / (download) - annotate - [select for diffs], Mon Feb 9 23:16:46 2004 UTC (21 years, 7 months ago) by henning
Branch: MAIN
Changes since 1.3: +14 -3 lines
Diff to previous 1.3 (colored)

print networks too

Revision 1.3 / (download) - annotate - [select for diffs], Mon Feb 9 01:46:34 2004 UTC (21 years, 7 months ago) by henning
Branch: MAIN
Changes since 1.2: +3 -3 lines
Diff to previous 1.2 (colored)

make max_prefix an u_int32_t instead of an u_long and change its
meaning as in 0 means no limit insytead of setting it to ULONG_MAX for
no limit

Revision 1.2 / (download) - annotate - [select for diffs], Mon Feb 9 01:38:55 2004 UTC (21 years, 7 months ago) by henning
Branch: MAIN
Changes since 1.1: +88 -1 lines
Diff to previous 1.1 (colored)

print more fluff

Revision 1.1 / (download) - annotate - [select for diffs], Sun Feb 8 23:44:57 2004 UTC (21 years, 7 months ago) by henning
Branch: MAIN

factor out functions to print the configuration (rules only for now)
will become more and needed by bgpctl too

This form allows you to request diff's between any two revisions of a file. You may select a symbolic revision name using the selection box or you may type in a numeric name using the type-in text box.